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Unconditional security proofs of the Bennett-Brassard protocol of quantum key distribution have 
been obtained recently. These proofs cover also practical implementations that utilize weak coherent 
pulses in the four signal polarizations. Proven secure rates leave open the possibility that new 
proofs or new public discussion protocols obtain larger rates over increased distance. In this paper 
we investigate limits to error rate and signal losses that can be tolerated by future protocols and 
proofs. 
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I. INTRODUCTION 

Quantum key distribution (QKD) 0,0 is a technique 
that exploits quantum effects to establish a secure se- 
cret key between two parties (usually called Alice and 
Bob). This secret key is the essential ingredient of the 
one-time-pad or Vernam cipher the only known en- 
cryption method that can provide information-theoretic 
secure communications. 

The first complete QKD scheme is that introduced by 
Bennett and Brassard in 1984 (BB84 for short) 0. In a 
quantum optical implementation of this protocol, Alice 
encodes each random bit into the polarization state of 
a single-photon: she chooses along one of two mutually 
unbiased bases, e.g. either a linear or a circular polar- 
ization basis. On the receiving side, Bob measures each 
photon by selecting at random between two polarization 
analyzers, one for each possible basis. As a result, Al- 
ice and Bob end up with some classical correlated data 
that can be described by a joint probability distribution 
P(A, B), where the random variables A and B represent 
the signal states prepared by Alice and the measurement 
results obtained by Bob, respectively. Next, Alice and 
Bob use an authenticated public channel to process these 
data in order to obtain a secret key. This second phase, 
usually called key distillation, involves, typically, posts- 
election of data, error correction to reconcile the data, 
and privacy amplification to decouple the data from a 
possible eavesdropper (Eve) |j . A full proof of the un- 
conditional security for the complete BB84 protocol has 
been obtained 

After the first experimental demonstration of the fea- 
sibility of the BB84 scheme jg, several experimental 
groups have realized long-distance implementations of 
QKD in the last years 0. However, these practical ap- 
proaches differ in many important aspects from the origi- 
nal theoretical proposal, since that demands technologies 
that are beyond our present experimental capability. Es- 
pecially, the signal states emitted by the source, instead 
of being single-photon signals, are usually weak coherent 
pulses (WCP) with a low probability of containing more 



than one photon (typical average photon- numbers are 0.1 
or higher). The quantum channel (e.g. optical fiber) in- 
troduces considerable attenuation and errors that affect 
the signals even when Eve is not present. Finally, the 
detectors employed by the receiver have a low detection 
efficiency and are noisy due to dark counts. All these 
modifications from the ideal BB84 protocol to real im- 
plementations can jeopardize the security of the proto- 
col, and lead to limitations of rate and distance that can 
be covered by these techniques H, . A positive security 
proof against all individual particle attacks, even with 
practical signals, has been given in ^(j- More recently, a 
complete proof of the unconditional security of the BB84 
scheme in a realistic setting has also been achieved [11) . 
This means that, despite of practical imperfections, it is 
still possible to obtain a secure secret key with the sup- 
port of the classical information techniques used in the 
key distillation phase. 

While all these positive security proofs are of great im- 
portance for QKD, they might be over-restrictive. This 
might be so either because of the particular mathematical 
techniques used in the security proofs, or because of the 
specific key distillation protocols considered. Different 
ideas to extend the proven secure regimes ofRef. iEl 
have been found 113, More recently, it has been 

shown that the ultimate limit for secure QKD is given by 
the proven presence of quantum correlations in P{A, B) 
fl2| : whenever the joint probability distribution P(A, B), 
together with the knowledge of the corresponding signal 
states and detection methods employed by Alice and Bob, 
can be interpreted as coming from a separable state then 
no secret key can be obtained, whatever classical protocol 
may be used in the key distillation phase. 

In this paper we are interested in this ultimate 
limit, given by the existence of quantum correlations 
in P(A, B), for practical QKD. In principle, to decide 
whether the joint probability distribution P(A, B), ob- 
tained after the first phase of QKD, contains quantum 
correlations, Alice and Bob can use all the information 
contained in P(A, B). However, we evaluate only those 
events where the signal preparation and detection meth- 
ods employed by Alice and Bob use the same polariza- 



2 



tion basis. Moreover, in this paper, we consider that 
Alice and Bob analyze only two particular events: The 
expected click rate at Bob's side, and the generalized er- 
ror rate. For this, we investigate a simple eavesdropping 
strategy based on intercept-resend attacks: Eve measures 
out every signal emitted by Alice and prepares a new 
one, depending on the result obtained, that is given to 
Bob. Intercept-resend attacks correspond to entangle- 
ment breaking channels and, therefore, they cannot 
lead to a secure key • This kind of attacks has been al- 
ready studied by Dusek et al. in Ref. 0] and by Felix et 
al. in Ref. [l7j . In particular, Dusek et al. considered the 
case where Eve realizes unambiguous state discrimination 
(USD) Em of Alice's signal states. Whenever Eve is 
successful with her USD measurement and she identi- 
fies the signal state sent by Alice, then she sends this 
information to a quantum source close to Bob via a clas- 
sical channel. This source prepares the identified quan- 
tum state and subsequently forwards it to Bob. If the 
identification process does not succeed, then Eve sends 
the vacuum signal to Bob to avoid errors. This attack 
does not introduce errors in the signal states, but it re- 
quires high losses in the channel. Note that in order to 
unambiguously discriminate between the four BB84 sig- 
nal states Eve requires that the signals contain, at least, 
three or more photons |l6l Il9j| . In this paper, we in- 
vestigate a different regime. Specifically, we propose a 
simple intercept-resend attack for the scenario where the 
attenuation introduced by the channel is not sufficiently 
high for Eve to perform the USD attack. This fact is 
compensated by allowing her to introduce some errors. 
As a result, we obtain an upper bound on the maximal 
distance achievable by the BB84 protocol as a function 
of the error rate and the mean photon-number of the sig- 
nals sent by Alice. Beyond this upper bound no secure 
QKD is possible. 

The paper is organized as follows. In Sec. [B] we de- 
scribe in more detail the signal states and detection meth- 
ods employed by Alice and Bob. Then, in Sec. II I II we 
introduce an intercept-resend attack for practical QKD 
and we derive an upper bound on the maximal distance 
achievable by the BB84 protocol. Finally, Sec. II VI con- 
cludes the paper with a summary. 



II. TOOLBOX FOR ALICE AND BOB 



Alice 



tion of mean /j, = \a\ 2 . Such states are described as 

oo n 
n=0 

where the states \nk) denote Fock states with n photons 
in one of the four BB84 polarization states, which are 
labeled with the index k, with k = 0, 3. 

The symmetry imposed by the BB84 protocol on the 
signal states \rik}, with n > 0, guarantees that there ex- 
ists a unitary transformation U (n) such that 

K) = £/(ra)|n fc _i) = U k (n)\n Q ) 
| no) = U(n)\n 3 ) 
U 4 (n) = 1. (2) 

For more details in our specific case see | l6j . The unitary 
operator U (n) can be expanded as 



U(n)=J2 ex P ( 27r 4)l & W> &i W I > ( 3 ) 
j=o \ ' 

where the states \4>j(n)) represent a set of orthogonal 
states. This allows us to write the states |rifc), with n > 0, 
as [IlEl 



K) = ]T Cj (n) exp ( 2m^ ) |^-(n)>, (4) 



where the coefficients Cj(n) satisfy J2j l c j( n )| 2 — !• The 
exact values of the coefficients |cj(n)| can be obtained 
explicitly using the overlaps of the four states \rik), with 
k = 0, 3, according to the formula 0] 
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^ exp I — 2ni 



j(l - m) 



(m\n m ). (5) 



As a result, one finds the expressions 0] 



\c (n)\ = ji+2-(i+»/ 2 )cos(|n), (6) 



r,i,M| = \/i + 2-( 1 +"/2) s i ri (^7i 



02 (n) | = Jj-2-( 1 +»/ 2 )cos(|n), 



C3(n)| = J~ -2-( 1 +"/2) s i I1 Qn). 



We consider that Alice uses WCP signal states de- 
scribed by coherent states with a small amplitude a. 
Moreover, we assume the typical scenario where there is 
no phase reference available outside Alice's setup. This 
results in effective signal states which are mixtures of 
Fock states with a Poissonian photon-number distribu- 



B. Bob 

Bob employs the active detection setup shown in Fig.^ 
It consists of a polarization analyzer and a polarization 
shifter that effectively changes the polarization basis of 
the subsequent measurement. The polarization analyzer 
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FIG. 1: The polarization shifter allows to change the polar- 
ization basis (+ and x) of the measurement as desired. The 
polarization analyzer consists of a polarizing beam splitter 
(PB) and two ideal detectors. The PB discriminates the two 
orthogonal polarized modes. Detection efficiencies are mod- 
eled by a beam splitter (BS) of transmittance rjdet- 



has two detectors, each detector monitoring one out- 
put mode of a polarizing beam splitter. These detec- 
tors are characterized by their detection efficiency rjdet- 
They can be described by a single-loss beam splitter of 
transmittance rjdet located after the transmission chan- 
nel, together with ideal detectors [2l|. We assume that 
the detectors cannot distinguish the photon-number of 
arrival signals, but they provide only two possible out- 
comes: "click" (at least one photon is detected), and "no 
click" (no photon is detected in the pulse). 

We obtain that Bob's detection device can be charac- 
terized by two positive operator value measures (POVM), 
one for each of the two polarization basis (3 used in the 
BB84 protocol 22]. Each POVM contains four elements 



FL = E \n,m)p(n,m\, 

n,m— 
oo 

F o = E (I" W* \n t m)p(n,ml 

n,m— 
oo 

F i = E \n,m) (n,ml 

n,m— 



(7) 



where rj = (1 - rjdet), and \n, m) p 

which has n photons in one mode and m photons in the 
orthogonal polarization mode with respect to the polar- 
ization basis (3. The outcome of the operator F$ ac cor- 
responds to no click in the detectors, the following two 
POVM operators, Fq and F^, give precisely one detec- 
tion click, and the last one, F^, gives rise to both detec- 
tors being triggered. 

The detectors show also noise in the form of dark 
counts which are, to a good approximation, indepen- 
dent of the incoming signals. The observed errors can 
be though as coming from a two-step process: in the 
first step the signals are changed by Eve as they pass the 
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denotes the Fock state 



quantum channel, in the second step random noise from 
the detector dark counts is added. If we assume that 
Eve cannot influence the second step, then only the error 
rate coming from the first step needs to be considered in 
the privacy amplification process of the key distillation 
phase. 

In principle, to decide whether the joint probability 
distribution P(A, B) obtained after the first phase of 
QKD contains quantum correlations, Alice and Bob can 
use all the information contained in P(A, B). However, 
we evaluate only those events where the signal prepara- 
tion and detection methods employed by Alice and Bob 
use the same polarization basis. Moreover, in this pa- 
per, we consider that Alice and Bob analyze only two 
particular events: The expected click rate at Bob's side, 
and the generalized error rate e. This generalized error 
rate takes into account also double clicks; these are not 
discarded, instead Bob decides at random a bit value for 
every double click . Let us emphasize once more that 
we consider only errors generated in the channel while 
subtracting errors coming from trusted but imperfect de- 
tectors with known dark count rates. 



III. INTERCEPT-RESEND ATTACKS 

Basically, an intercept-resend attack consists in Eve 
measuring out every signal emitted by Alice. Afterwards, 
she transmits the measurement results through a lossless 
classical channel to a source close to Bob, which prepares 
new signal states that are forwarded to Bob. These eaves- 
dropping strategies transform the original quantum chan- 
nel between Alice and Bob into an entanglement breaking 
channel and, therefore, they do not allow the distri- 
bution of a secret key [l2|. 

Next, we propose a simple intercept-resend attack for 
the BB84 protocol that is specially suited for the signal 
states and detection methods employed by Alice and Bob, 
together with the attenuation introduced by the channel. 
Let us mention already here that this attack might not be 
optimal, but, as we will show below, it already imposes 
strong restrictions on the maximal distance achievable 
by the BB84 protocol with realistic means. But before 
addressing the whole analysis for this attack, let us start 
by describing it from a qualitative point of view. 

We begin by introducing Eve's measurement device. 
For simplicity, we decompose it into three steps: in the 
first step, Eve obtains the total photon-number, n, of 
each signal state sent by Alice. This information can 
be acquired via a quantum-non- demolition (QND) mea- 
surement that does not introduce any errors in the sig- 
nal states. Thanks to this information, the problem of 
identifying which polarization state k was used by Al- 
ice is reduced to the problem of distinguishing between 
four pure symmetric states \rik}, with k = 0, ...,3. Once 
the photon-number n is known, Eve uses the value of 
the losses in the channel expected by Alice and Bob to 
discard some signals. For that, she performs a filter op- 



4 



eration on the states \rik) with the intention to make 
them, with some finite probability, more "distinguish- 
able", while keeping the symmetry property of the set. 
The signal states that has to be discarded are those for 
which the filter operation does not succeed. The natural 
restriction here is that the probability of the filter op- 
eration to discard signals has to mimic the losses in the 
channel. Finally, in the third step, Eve measures out each 
filtered state with the so-called square-root-measurement 
(SRM) [20I l24l ] . This measurement gives her the mini- 
mum value of the error probability when distinguishing 
symmetric states. After deciding which polarization state 
was used by Alice, Eve needs to prepare a new signal in 
the state identified and give it to Bob. For that, we as- 
sume that she uses the signal states described by Eq. Q , 
but without the vacuum component. 

Next, we study each of these steps in more detail. The 
objective is to find the error rate introduced by Eve with 
the intercept-resend attack described above for a given 
value of the losses in the channel and of the mean photon- 
number of the signal states. 

A. Filter Operation 

The purpose of this operation is to make, with some 
finite probability, the four possible input states \nk), with 
k = 0, ...,3 and n > 0, more "distinguishable". For that, 
we assume that Eve uses the filter operation defined by 
the following two Kraus operators |2q : 

3 

A succ {n) = J2 a j( n ) l0j( n ))(«M n )l> ( 8 ) 
3=0 
3 

A f aii(n) = X^-M")! 2 \Mn))(Mn)\> ( 9 ) 
3=0 

where the states \<j)j(n)) represent the set of orthogonal 
states introduced in Eq. ©. The coefficients otj{n) sat- 
isfy |ctj(n)| 2 < 1 for all j = 0, 3 and for all n > 0. 

Suppose now that the filter operation receives as in- 
put the state \rik)- The probability of getting a success- 
ful result, Pr succ {n), can be calculated as Pr succ {n) = 
Tr(\n k )(n k \ A\ ucc (n)A succ (n)). This quantity is given 
by 

3 

Pr succ (n)=Y / \lj(n)\ 2 , (10) 
3=0 

where jj(n) = aj(n)cj(n). If the filter operation suc- 
ceeded, the resulting normalized filtered state, that we 
shall denote as \n s k ucc ), can be calculated as \n s k wcc ) = 
(1/ \JPr succ {n)) A succ (n)\nk) ■ We obtain 



Note that, as desired, the set of states \nt ucc ). with k = 
0, 3 and n > 0, forms still a symmetric set [l9ll20| . 

As mentioned previously, the filter operation has to 
be designed such as e _A1 Y^?=i i ^rP r succ( n ) equals the 
probability of a signal state to arrive at Bob's detection 
device, i.e. 



"u n 

e -M J2 t-Pr sacc (n)=l-e-^, (12) 

71=1 

where r\t is the transmission efficiency of the quantum 
channel (2(|. 



B. Square- Root-Measurement 

In order to decide which polarization state k was used 
by Alice, we consider that Eve follows the approach of 
minimum error discrimination. That is, her aim is to 
find for each signal state sent by Alice a measurement 
strategy that guesses the value of k with the minimum 
probability of making an error. As introduced previously, 
for the case of pure symmetric states \n s k ucc ) with equal a 
priori probabilities, like it is the case that we have here, 
the optimal minimum error discrimination measurement 
is given by the so-called square-root-measurement (SRM) 

Hail. 

This measurement can be characterized with four 
POVM elements: F k (n) — \uo k (n)) (uj k (n)\, with k 
I j. .... .'i. The states \uj k (n)} are not necessarily normal- 
ized or orthogonal, and they can be obtained from the 

— 1/2 

states \n k ucc ) as \u)k(n)) — $(n) \n s k ucc ), where the 

operator $(n) is defined as $(ra) = J2k=o l n I ucc )( n fc icc |- 
Using the symmetric representation of \n s k ucc ) given by 
Eq. ltTT|) we obtain 



where the angles tpj (n) denote the complex arguments of 
the coefficients 7j(n), i.e., ^j{n) = arg(7 J (n.)). 

The probability, Pr kk (n), of obtaining the result k 
when the output state from Eve's QND measurement 
is \rik}, with n > 0, and the filter succeed is given by 
Pr kk (n) = Tr(|nr c )K" cc | F~ k (n)) = |(n|« cc |^(n))| 2 . 
According to Eq. {TTJ and Eq. {T3J) we find that this 
probability is of the form 



\ ^ 



^>(n)ex P (^z^V-H). pr , , _ Ef, m= ol7K")7 m (")|exp(27r» ( fc - fc )i'-^ ) 

(11) (14) 
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C. Signal preparation 



can be expressed as a function of only two probabilities 



Once Eve has measured all the signal states sent by 
Alice, she needs to prepare new signal states and give 
them to Bob. The objective of Eve is to minimize the 
error rate while reproducing the expected click rate at 
Bob's side. One possible solution for Eve in order to 
fulfill this condition is the following: Whenever the signal 
states sent by Alice contain, at least, one photon (n > 0) 
and the subsequently filter operations were successful, 
Eve gives Bob the signal states 



1 - e-vm 



n=l 



K){n~ k l (15) 



where k denotes the polarization states identified with 
the SRM. Otherwise, Eve sends Bob the vacuum state. 

Let us emphasize that for each state p k sent by Alice, 
Eve can prepare five possible states: the four states /9~ ucc 

given by Eq. (|TB|) . with k = 0, 3, and the vacuum state. 

Finally, in the next section, we obtain the error rate e 
introduced by this intercept-resend attack as a function 
of the losses in the channel and the mean photon- number 
of the signal states sent by Alice. 



e(n) 



2 

£ 



Pr 0j (n), 



(16) 



for all k. If we insert into this expression the value of the 
probabilities Pr kk (n) given by Eq. 114(1. we obtain 



e(n) 



Ei,m=0 l72i( n )72m+l(n)| 



2Pr s 



-Xn) 



(17) 



The final error rate e can be calculated from the partial 
error rates e(n), just by taking into account the a priori 
probabilities of the signal states to contain n photons, 
together with the probability of the filter operation to 
generate a successful result. This way we obtain that e 
is given by 



1 - e -mt 



^ — Pr sacc (n)e(ri). 



71=1 



(18) 



Using the values of -Pr succ (n) and e(n) given by Eq. i|10|) 
and Eq. tfTTft . respectively, and employing Eq. (|T2|) we 
finally obtain 



D. Error-rate in the sifted key 

As introduced previously, here the error rate e refers 
only to those events where Alice and Bob use the same 
polarization basis for the signal preparation and for the 
detection method, respectively. Moreover, we consider 
that double clicks contribute also to the error rate with 
probability i. It turns out that the intercept-resend at- 
tack presented above introduces the same error rate e for 
all the four possible polarizations states k used by Alice, 
and the resulting joint probability distribution P(A, B) 
after Eve's attack has some expected symmetries. (See 
Appendix lAl ) From Eq. Q we obtain: whenever Eve 
identifies the right polarization state, k = k, then no er- 
rors are introduced; if Eve obtains a polarization state 
orthogonal to the one sent by Alice, \k — k\ = 2, then 
e = 1; finally if Eve obtains one of the other two possible 
polarization states, \k — k\ = 1 or \k — k\ = 3, then e = i. 
When Eve sends to Bob the vacuum state then no errors 
are introduced. 

Let us start our analysis by obtaining an expression 
for the partial error rate e(n) coming from a signal state 
containing n photons, with n > 0. According to the pre- 
vious paragraph, we have that e(n) is the same for all k. 
This means that we can calculate e(n) for the case where 
Alice used, for instance, k = 0. For this case we obtain 
e(n) = Pr Q2 {n) + \ {Pr Q1 {n) + Pr 03 (n)). The probabili- 
ties P kk given by Eq. ifTH) satisfy Pr i(n) — Pr 3(n) for 
all n > 0. This means that the partial error rate e(n) 



2 V 1 - e~w ^ n 

n=l Lm=0 



— 22 l72i(«)72m+lW 



(19) 



Next, we calculate explicitly e for different values of 
the losses in the channel and of the mean photon-number 
of the signal states sent by Alice. We distinguish two 
cases. First we analyze the case of low losses in the chan- 
nel. Then we analyze the situation of high losses in the 
channel. The reason to study these two scenarios sepa- 
rately arises from the fact that, as we will show below, 
for signals states containing < n < 2 photons the filter 
operation reduces to a multiple of the identity operator. 



1. Case 1; Low losses in the channel 

Let us start with the case where the channel does not 
introduce any attenuation at all, i.e. r\ t = \. From 
Eq. I|12|) we have that the probabilities Pr stlcc (n) must 
satisfy: Pr succ (ri) — 1 for all n > 0. That is, the filter 
operation is reduced as expected to the identity opera- 
tion for all n > 0. According to Eq. (|19fl we find, in this 
case, that the error rate e is given by 



-u °° ,,n 1 

— yt_ y 

g — /j / n \ Z-^i 

n—1 l.m—Q 



|C22( n ) c 2m+lH| 



(20) 
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As soon as the channel begins to introduce some losses, 
i.e. rjt < 1, Eve can start to use her filter operation to 
decrease the value of the error rate e. In this scenario, we 
can distinguish two regimes where the calculations follow 
quite straightforward. 

The first regime arises from the fact that, whenever 
the signal states sent by Alice contain only one pho- 
ton, n = 1, the filter operation does not help to make 
the states with k — 0, ...,3, more distinguishable. 

(See Appendix [Bj) For these states the partial error 
rate e(l) is fixed and given by e(l) = \, independently 
of the losses in the channel. (See Appendix iBl ) Since 
e(l) > e(n) and Pr(l) > Pr(n) for all n > 1, where 
Pr(n) denotes the probability of Alice's signal states to 
contain n photons, we obtain that the best strategy for 
Eve is to start employing the losses in the channel to 
discard first all the single-photon signals, before she be- 
gins to filter the multi-photon pulses. From Eq. (|12|l . 
and imposing Pr succ (n) = 1 for all n > 2, we find 
that the probability of discarding single-photon signals, 
Prfail(l) = 1 - fV aucc (l), is given by 

p(l-»7t) _ 1 

Pr fai i(l) = . (21) 

All the single-photon signals are discarded as soon as 
Prfaii(l) = 1, i.e. when rjt = 1 — ln \~ p ^ ■ Inserting 
these values of Pr succ (n) and e(n) in Eq. I|18[) we find, 
therefore, that in the interval 
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FIG. 2: Error rate e in the sifted key for the case rj t > 1 — 

2 

ln(l + fi + ^-)/fjL, and for different values of the mean photon- 
number: n — 0.1 (solid), /j, = 0.2 (dashed), [i = 0.3 (dashdot), 
fj, = 0.4 (dotted). The four solid lines on the left hand side 
of the graphic represent an upper bound for the tolerable 
error rate e arising from known security proofs [Tl| . Each line 
corresponds to a different value of the mean photon-number 
with the values (j, = 0.1, (i = 0.2, /i = 0.3 and fj, = 0.4 from 
the outer to the inner line. 

n-photon signals, with n > 3. From Eq. 118(1 we find, 
therefore, that the error rate e in this regime is of the 
form 



i > m > l - 

the error rate e is given by 
1 



In (1 + fi) 



(22) 



e = -n 

2 1 1 - e-m 



I(l+ M - e M(i-*)) 



X! ~T X/ \c2i(n)c 2m+1 (n)\ 



ra=2 



Lm=0 



(23) 



It turns out that the optimal filter operation reduces 
also to a multiple of the identity operator for the case n = 
2. (See Appendix 0) That is, the filter operation does 
not help either to make the states |2fc), with k — 0, 3, 



more distinguishable and e(2) = 



2-V2 



independently of 



the losses in the channel. (See Appendix [BJ) The same 
argumentation used above for the case n = 1 can also be 
employed here to find that in the regime given by 



In (1 + fx) 



> Vt > 1 



In + 



(24) 



Eve needs to discard first the two-photon signals, before 
she starts to use the filter operation with the remaining 



e = -< 1 

2 1 1 - e-^t 



7T \ C 2l( n ) c 2m+l{n)\ 



1 , a 

7i (1 + M + T- e 



n< 

n=3 l.rn=0 



(25) 



where we have omitted the intermediate calculations 
since they are analogous to the previous case n = 1. 

The value of e for these two scenarios, i.e. for the case 
r]t > 1 — hi(l + (j, + is illustrated in Fig. |21 as a 

function of the losses in dB of the quantum channel [2(| , 
and for different values of the mean photon-number /i. 
We also include in Fig. [2] a bound for tolerable error rate 
arising from established security proofs 0, 1^3 . Note 
that these proven secure regions will be extended thanks 
to recently proposed key distillation methods fl4| . 



2. Case 2: High losses in the channel 
In this section we consider the final case of rj t satisfying 



1 



La (1 + 



> Vt > 0. 



(26) 
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This scenario corresponds to the case where Eve has al- 
ready discarded all the single-photon and all the two- 
photon signals, and she can start to use her filter opera- 
tion with the remaining n-photon pulses, with n > 3. In 
this case, the error rate e is given by Eq. I|19|) but with 
the first summation starting at n = 3. 

The objective of Eve is to find, for a given value of the 
mean photon-number \x and for a given value of r\ t inside 
the interval given by Eq. I|26|) , the coefficients ctj (n) of the 
filter operation, with n > 3, that minimize e. Moreover, 
this has to be done in a way that Eq. (|12[1 is fulfilled, 
with Pr succ (l) = Pr succ (2) = 0. This problem can be 
reduced to solving the following non-linear optimization 
problem with equality and inequality constraints 



0.03 
0.025 

0.02 
0.015 

0.01 
0.005 



^5 



20 



25 

Losses (dB) 



35 



FIG. 3: Upper bound for the error rate e for the case s — 5 
1 (See Appendix lC|l . rjt < 1 — lnfl 4- u+ ^-) la. and for different 

EfJ> n -sr^ I / \ / \i values of the mean photon-number: /i = 0.1 (solid), /i = 0.2 

^ 1^ l72iW72m+l(«j|, (dashed), (i = 0.3 (dashdot), u = 0.4 (dotted). The points 

with e = correspond to the USD case when s — > oo. 



™=3 Lm=0 



x ,,n 3 1 
A 1 I f„\|2 _ 1 



subjectto 2^—2^ |7j(n)l 



n! 

=3 j=0 



< |7i(n)| < \cj(n)\ Vj, and Vn > 3, 

(27) 



IV. CONCLUSION 



where the infinitely many inequality constraints < 
|7j(^)| < l c j( n )l guarantee that |aj(n)| 2 < 1 for all 
j = 0, 3, and for all n > 3. 

The non-linear optimization problem given by Eq. I|27|) 
is not easy to handle, since it involves infinitely many 
variables and infinitely many constraints. However, as 
we show in Appendix [U] one can easily obtain a good 
upper bound on the error rate e by considering only an 
optimization problem with a finite number of variables 
and constraints parametrized by a parameter s < oo. 
This finite-variable optimization problem can then be 
solved numerically. (See Appendix IU1) This approxi- 
mation corresponds to considering only a restricted class 
of eavesdropping attacks. In Fig. we plot the result 
for the case s = 5, and for different values of the mean 
photon-number fi and of the parameter rj t . (See Ap- 
pendix|Cl) The existing gap between the minimum error 
rate e achieved by each curve in Fig. [21 and the value 
e = is due to the fact that for each restricted class of 
attacks there is a minimum value of e that can be ob- 
tained. When s increases then the minimum value of 
the error rate e that one can reach with these restricted 
strategies approaches zero for sufficiently high losses. In 
the limit s — > oo then e = for the transmission efficiency 
rjt plotted with a point in Fig. [3] This case correspond 
to the USD attack. (See Appendix IU1) Moreover, in this 
limit s — > oo the upper bound for e represented in Fig. El 
coincides with the optimal value of e. 



In this paper we have investigated the ultimate limit 
for secure practical QKD given by the proven existence 
of quantum correlations between Alice and Bob. In prin- 
ciple, to decide whether the joint probability distribution 
P(A, B) obtained after the first phase of QKD contains 
quantum correlations, Alice and Bob can use all the in- 
formation contained in P(A, B). However, we evaluate 
only those events where the signal preparation and detec- 
tion methods employed by Alice and Bob use the same 
polarization basis. Moreover, in this paper, we consider 
that Alice and Bob analyze only two particular events: 
The expected click rate at Bob's side, and the generalized 
error rate. For that, we have analyzed a simple eaves- 
dropping strategy based on intercept-resend attacks: Eve 
measures out every signal emitted by Alice and prepares 
a new one, depending on the result obtained, that is 
given to Bob. These kind of attacks correspond to en- 
tanglement breaking channels and, therefore, the result- 
ing correlations cannot lead to a secure key. Specifically, 
we have proposed an intercept-resend attack for the sce- 
nario where the attenuation introduced by the channel 
is not sufficiently high for Eve to perform unambiguous 
state discrimination of the signal states sent by Alice, 
but now she is allowed to introduce some errors. As a 
result, we obtained an upper bound on the maximal dis- 
tance achievable by the BB84 set-up with realistic means. 
This upper bound depends on the error rate in the sifted 
key, and on the mean photon-number of the signals sent 
by Alice. It states that no key distillation protocol can 
provide a secret key from the correlations established by 
the users. 
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APPENDIX A: JOINT PROBABILITY 
DISTRIBUTION P(A,B) 

In this Appendix we provide the resulting joint prob- 
ability distribution P(A, B) obtained by Alice and Bob 
after Eve's attack, and we show that P{A, B) has some 
expected symmetries. 

In order to do that, let us start by introducing some 
notation: we shall denote each element of P(A, B) as 
P(Ak,Fj 3 ), where the index k = 0, ...,3 labels the four 
possible BB84 polarization states pk prepared by Alice, 
and the two indexes (3 — {+, x}, and i — {vac, 0, 1,-D}, 
represent the two POVMs {F^ ac , F$, pf , F%} character- 
izing Bob's detection setup, and the four possible out- 
comes for each of these two POVMs, respectively. 

The probabilities P(A k ,Ff) can be calculated as 

4 

P(A k ,Ff) = Pr( Pk )Y, Pr(p- k \p k )Pr(F?\p k ), (Al) 
k =o 

where Pr{p k ) denotes the a priori probability that Al- 
ice sends to Bob the quantum state p k , Pr(p k \p k ) refers 
to the conditional probability that Eve forwards to Bob 
the quantum state p k after receiving from Alice p k , and 
Pr(F[\p k ) denotes the conditional probability that Bob 
detects the event characterized by Ff after obtaining 
from Eve p k . Note that here we decide to use the states 
p k , with k — 0, ...,3, to denote the four possible states 
p| ucc given by Eq. (|15|l . while the state p k , with k = 4, 
refers to the vacuum state. 

In the standard BB84 protocol we have that Pr(p k ) = 
j for all k. The conditional probabilities Pr(Ff\p k ) can 
be calculated as Pr(Ff\p k ) = \Tr(Ff p k ). We illus- 
trated the result for Pr(Ff\p k ) in Tabled where the 
parameters a, 6, c, and d are given by 

a = -( e-wt^t - e -m ) 

2(l-e-^*)\ / 

b = -(l-er mt ^A, 

2(l-e-w)\ / 

c = I (V^^-p-™^ 

" 2(l-e-A"h)\ /' 

d = — - — -fi +e -~ t _ 2e -™-y 

2(l-e-^*)\ J 

(A2) 
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TABLE I: Conditional probability Pr(F?\p % ). 



The conditional probabilities Pr(p k \p k ) can be calcu- 
lated as 



Pr{p- k \p k ) = e~» Y, ZJ Pr ^c(n)Pr kk (n), (A3) 

n=l 

for the case k — 0, 3, with Pr kk {n) being the probabil- 
ity that Eve obtains the result k when the output of her 
filter operation is \n s k ucc ). Including the value of Pr kk (n) 
given by Eq. (|14|) into Eq. (| A3|> we find, therefore, that 
for the case for k = 0, 3, Pr(p k \p k ) is given by 

Pr(P k \Pk) = — Y n\ NO)7mfa)l 

n=l l,m=0 

/ (k-k)(l-m)\ 
exph^ ^ -J, (A4) 

In the case k = 4 we find 



Pr(p- k \p k ) = e-» + e-»Y ^i 1 ~ ^w(n)), (A5) 

n=l 

According to Eq. (|12ll . this last conditional probability 
reduces to Pr(p k \p k ) = e~ mt for k = 4 and for all k. 

Now we can show that the joint probability distribu- 
tion P(A, B) exhibits the symmetry property expected in 
typical situations in QKD. That is, if Alice and Bob em- 
ploy the same polarization bases to prepare and measure 
the signal states, then the probability that Bob identifies 
the correct state has to be the same for all k. This sym- 
metry applies also to the situation where Bob obtains as 
a the result a state orthogonal to the one sent by Alice. 
Moreover, if Alice and Bob do not use the same bases in 
the preparation and detection methods, then the prob- 
abilities to obtain the results characterized by the two 
operators Ff, with i = 0, 1, has to be the same for all k 
and for all (3. 

Note that the probabilities P kk {n) given by Eq. I|14|) 
satisfy the following symmetry property: P k k{n) is the 
same for all k, and P kk {n) has the same value for those 
events satisfying: \k— k\ — 1 and \k— k\ — 3. According to 
Eq. (|A3|) we find that these properties are also fulfilled 
by Pr(p k \p k ). Combing this result with the symmetry 
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P{A,B) 


n+ 
r 

-*- ?jac 


7-1 + 


^9 


7-1-1- 

D 


■*■ vac 


n X 
^0 


n X 

F* 


n X 
D 


k = 
k = 1 
k = 9 
k = 3 


0.121997 
0.124997 
0.124997 
0.124997 


2.6768 10" 5 
1.3519 10~ 6 
2.7076 10" 8 
1.3519 10~ 6 


2.7076 10 -8 
9.3519 10~ 6 
2.6968 10~ 6 
1.9519 10~ 6 


2.9640 10 -13 
1.4331 10" 11 
2.9140 10 -13 
1.4331 10 -11 


0.123997 
0.524997 
0.124997 
6.124397 


3.3519 10" 6 
2.6768 70~ 6 
1.3519 10^ 6 
2.7076 10~ 8 


1.3819 10 -6 
2.7076 10~ 4 
1.3512 10 -6 
2.6768 10~ 6 


1.4331 10 -11 
2.9040 18" 13 
1.4331 10~ n 
2.9140 10 -13 



TABLE II: Joint probability distribution P(A, B) after Eve's attack for the case: fx = 0.1, r] t « 6.201 (« 29.7cLB), and 
Vdet = 0.2. The error rate is e ~ 0.01. In order to solve Eq. (IA4I we used s — 5. 



present in the conditional probability Pr{F?\pi) given 
by Tabled it turns out that P(A, B) satisfies the desired 
symmetry property. 

We illustrate this result in Table ITT1 where we plot the 
resulting P(A, B) after Eve's attack for the case: fi = 0.1, 
rj t m 7.001 (« 29.7dB), and % e i = 0.2. The error rate for 
this example is e 0.00. In order to calculate the value 
of Pr(pi i \pk) given by Eq. (|A4I) . we follow the same ap- 
proach that is explained in Section flll Dl and in Appendix 
ICl That is, instead of solving the complete optimization 



problem given by Eq. I|27|) in order to to find the optimal 
coefficients 7j(n), for all n > 0, we made a cut-off on 
the maximum number of multi-photon signals that are 
filtered by Eve. This way we can easily find numerically 
a solution to the original problem that approximates the 
global optimum. (See Appendix C.) For the case illus- 
trated in Table Ull we consider that Eve filters only those 
multi-photon signals such as n < a = 5. (See Appendix 
C.) 



APPENDIX B: FILTER OPERATION (n = l,n = 2) 

In this Appendix we show that if the signal stated sent 
by Alice contain only < n < 2 photons, then the filter 
operation reduces to a multiple of the identity operator, 
and e(l) = j and e(2) = 2 ~ 3 v/ ^ independently of the 
losses introduced by the channel . 

Let us start with the case n — 1. From Eq. 10 we have 
that the coefficients cj(l) of the symmetric representation 
of the states \lk)> with k = 0, ...,3, satisfy: |cg(l)| = 
| ci = -7= and |c 2 (l)| = | c 3 ( L ) | = 0, respectively. From 
Eq. i|17fl we obtain that, in this case, the partial error rate 
e(l) is given by 



e(0) 



1 1 1^(1)^(1)1 

2 2Mi)| 2 + Mi)l 2 



(Bl) 



It is easy to see that this quantity fulfills e(l) > | for all 
|oy(l)| 2 < 1- Its minimum value, e(3) = 4, is attained 
for |«o(l)| = |ai(l)|. That is, independently of the losses 
in the channel, the filter operation reduces to a multiple 
of the identity operator. 

The analysis for the case n = 2 is similar. Now the 
coefficients Cj(2) of the signal states |2fc) are of the form 
M8)| = |c 7 (2)| = i, |ca(2)| = ^, and |c 3 (2)| = 0, 
respectively. The partial error e(2) is given by 



r2 s = l 1 |ao(2) a i(2)| + | ai (6)a 2 (2)| . . 
A) 2 V2|a (2)P+ 2|a 1 (2)r + |a 2 (2)p- 1 > 

This quantity is bounded from below by e(2) > w 



0.15 for all |a ;) (2)| 2 < 1. Its minimum value, e(2) = 
2 ~ 4 v/2 ~ , can be achieved again directly with a filter oper- 
ation that is a multiple of the identity operator, i.e. by 
imposing |«o(2)| = |ck4 (8)| = |aa(2)| independently of 
the losses introduced by the channel. 



APPENDIX C: OPTIMIZATION PROBLEM 

In this Appendix we obtain an upper bound for the 
error rate e for the case of high losses in the channel, i.e. 
r] t < l-ln(l + /i 

In order to do that, we well consider that Eve employs 
her filter operation to filter first only those n-photon sig- 
nals that satisfy 3 < n < s, for some s > 0. The remain- 
ing n-photon signals, with n > s, are measured directly 
by Eve with the SRM, without filtering these signals. 
That is, we consider that Pr succ (n) = 1 for all n > s. 

From the limit given by USD [H E3 we know that 
Eve filters completely all the n-photon signals with 3 < 
n < s, i.e. e(n) = for all n G [3, a], when Pr succ (n) — 
4|c mm (n)| 2 , where |c mm (n)| = minj-|cj(n)|. This fact 
corresponds to the case where all the coefficients Qtj(n) 
of the filter operation arc of the form otj(n) = c "'^"^ , 

i.e. |7j(«)| = \c m i n (n)\ for all n € [3, a]. According 
to Eq. I|12|l . we obtain that this limit is given by the 
following transmission efficiency of the quantum channel: 



In (1 



(CI) 
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where the probability P m is of the form 



Ps = e 



E ^4|c mm (")| 2 + E (C2) 

( n— 3 n=s+8 

From Eq. I |19f t we obtain, therefore, that in the interval 



i ln(l + /i + ^) 



> % > : 



(C3) 



an upper bound for the error rate e, that we shall denote 
as e s , is given by 



1 - e"^* 



(C4) 



+ E — E \ c u(n)c 2m +i(n)\ 



n=s+l l,m=0 

where x s min represents the solution to the following non- 
linear optimization problem 



minimize ~ E ^7 E l72/(rc)72m+i(«)|, 



n=3 l,m=0 
s „ 3 

M 



subject to E "^i"E l7i( 



71! 

oo „ 



1 - e~w 



E 



n=s+l 

< |7j(n)| < |c,(n)| Vj, and Vn e [3, s]. 

" (C5) 

This optimization problem involves 4(s — 2) variables and 
8(s — 4) + 1 constraints, and it can be solved numerically. 

In the limit s — > oo the optimization problem given 
by Eq. (|C5j) reduces to the one given by Eq. l|2"7)l. To 
see how tight is the upper bound e s in general, note that 
e s — e is given by 



1 - 



n — 3 



PrZUn)e opt (n))+ £ ^-(e(r 



n— s+1 



PrS^(n)e^(n)) 



(C6) 



where Pr^ ucc (n) and e s (n), with 3 < n < s, are ob- 
tained from solving the optimization problem given by 
Eq. (EH), PrZldn) and e opt (n), with n > 3, refer to 
the optimal values of Pr succ (n) and e(n) obtained from 



solving Eq. (|2Tjl . Moreover, e(n) denotes the value of 
e(n) without using the filter operation, i.e. for the case 

l7i( n )l = l c j( n )l f° r au 3 — 0j •••) 3, and for all n > s, and 
is given by 



1 / 1 

= -z 1 - E l C 2i(«) c 2m + lH| 



i,m=0 



(C7) 



We find that Pr s succ (n)e s (n) - Pr^ cc (n)e°^ ! (n) < 
for all 3 < n < s. This is the case since for a 
given value of the losses in the channel r\ tl the problem 
given by Eq. I|C5|I uses r\ t to filter only a finite num- 
ber of signals. Note that in Eq. (|27[1 r\ t is distributed 
to filter all the signals. Moreover, it is evident that 
e(n) — Pr°J* cc {n)e° pt (n) < e(n) for all n > m, since we 
have that Pr°P* c (n)e opt (n) > 0. This way, we obtain 
that 



e < 



< 



1 - e~m 



E—re(n) 



n— s+1 



1 - e~m 



7 £ 

n— s+1 



(C8) 



where in the last inequality we have used the fact that 
e(n) < 1 for all n. To conclude, note that in the interval 
of rjt given by Eq. I|C3J) the expected click rate at Bob's 
side, P exp — l~e~ mt , is much bigger than the probability 

Pr(n > s) — e~ M J2^= s +i 01 Alice's signal states to 
contain more than s photons. Most importantly, this 
happens already for quite small values of s, e.g. s = 5. 

In Fig. |2| we plot e s for the case s = 5, and for different 
values of the mean photon-number /j and of the parame- 
ter r/ t . In order to solve the minimization problem given 
by Eq. I|C5|I we use the package Gloptipoly |2g based 
on SeDuMi |2jj, which is freely available. This package 
has a number of desirable features, in particular, it pro- 
vides a certificate for global optimality. It is based on the 
method introduced by Lasserre [3(J (see also (U) to solve 
a global optimization problem with a multivariable poly- 
nomial objective function subject to polynomial equality 
and inequality constraints. Lasserre's method finds hi- 
erarchies of solutions to the original problem in a way 
that each step in the hierarchy provides a better approx- 
imation to the global optimum than the previous one. 
Each step itself amounts to solving an efficiently implc- 
mentable semi-definite program 32]. Moreover, the hi- 
erarchy is asymptotically complete, in the sense that the 
exact solution is asympotically attained. For the prob- 
lem given by Eq. i|C5(l we find that the global optimum 
is already obtained after the first relaxation step. 

We include also in Fig. Othe minimum value of r\ t that 
satisfies e = 0. This corresponds to the USD case where 
Pr SUC c(n) = 4|c mm (n)| 2 for all n > 3 (s -f oo) Ed. 
According to Eq. I)12p. we obtain that this limit is given 
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by 



ln(l-Pr 



(C9) 



where the probability Pr> is of the form 0] 



Pr 



n— 3 



' 7 , '—r^\c min {n)Y 



(CIO) 



= 1 - e-» ( V2sinh + 2 cosh - 1 
V V2 V2 
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